@tula-tech/contract 0.2.0 → 0.3.0

package/dist/organization-domain-rules.d.ts

@@ -0,0 +1,132 @@
+/** Longest a whole domain can be, in characters (RFC 1035). */
+declare const MAX_DOMAIN_LENGTH = 253;
+/** Longest one label of a domain can be, in characters (RFC 1035). */
+declare const MAX_DOMAIN_LABEL_LENGTH = 63;
+/** Shortest a domain can be: `a.bc`. */
+declare const MIN_DOMAIN_LENGTH = 4;
+/**
+* How many domains one organization can claim, verified or waiting for a code. A bound so that
+* a signed-in administrator cannot fill the table.
+*/
+declare const MAX_DOMAINS_PER_ORGANIZATION = 10;
+/**
+* How long a verification of a domain lasts, in days.
+* A domain can be lost and registered again by someone else, and nothing tells Tula, so a
+* claim is only believed for this long: past it the domain matches nobody (no auto-join, no
+* suggestion) until a manager proves it again with a new emailed code. Counted from the day
+* the code was entered.
+*/
+declare const DOMAIN_VERIFICATION_LIFETIME_DAYS = 365;
+/**
+* How many days before a verification lapses the organization's managers are emailed, largest
+* first. Each is sent once per verification: a reminder is never repeated, and re-verifying
+* starts the series again.
+*/
+declare const DOMAIN_REMINDER_DAYS: readonly number[];
+/**
+* The least time, in days, that a domain verified before the lifetime existed (migration
+* 0042) keeps matching after the migration: its deadline is the later of the original
+* `verified_at` plus the lifetime and this many days from the migration, so that nobody is
+* cut off the day the change ships and every manager gets a reminder before it ends.
+*/
+declare const DOMAIN_REVERIFICATION_GRACE_DAYS = 30;
+/** What a domain row is: waiting for its first code, verified, or past its lifetime. */
+declare const ORGANIZATION_DOMAIN_STATUSES: readonly ["pending", "verified", "needs_reverification"];
+/** One of {@link ORGANIZATION_DOMAIN_STATUSES}. */
+type OrganizationDomainStatus = (typeof ORGANIZATION_DOMAIN_STATUSES)[number];
+/** How an organization treats a user who signs up with a verified address on its domain. */
+declare const ORGANIZATION_DOMAIN_MODES: readonly ["suggest", "auto_join"];
+/** One of {@link ORGANIZATION_DOMAIN_MODES}. */
+type OrganizationDomainMode = (typeof ORGANIZATION_DOMAIN_MODES)[number];
+/**
+* The grammar of a claimable domain: two or more labels of lower-case ASCII letters, digits
+* and hyphens (none at a label's end), joined by single full stops, the last label letters
+* only (or punycode, `xn--…`). So: no upper case, no trailing full stop, no port or path, no
+* underscore, no `@`, no wildcard, and no IP address (a numeric last label is refused, and so
+* is the bracketed IPv6 form).
+*
+* **Internationalised domains are written in punycode** (`xn--bcher-kva.example`, never
+* `bücher.example`): Unicode is refused, not converted, so a domain is stored and compared in
+* the one spelling a mail server uses. The pattern is the grammar alone; the length bounds
+* ({@link MAX_DOMAIN_LENGTH}, {@link MAX_DOMAIN_LABEL_LENGTH}) and the public list are
+* {@link domainRefusal}'s. `domainRefusal` runs it only over text of at most twice the length cap,
+* so its work is bounded.
+*
+* @example
+* ```ts
+* DOMAIN_PATTERN.test('acme.com') // true
+* DOMAIN_PATTERN.test('Acme.com') // false
+* DOMAIN_PATTERN.test('192.168.0.1') // false
+* ```
+*/
+declare const DOMAIN_PATTERN: RegExp;
+/** Why a string is not a claimable domain. */
+type DomainRefusal = "grammar" | "length" | "public";
+/**
+* Domains that anyone can get an address at, and that so prove nothing about the holder of an
+* address on them. **Documented here and nowhere else**: a claim of one is refused
+* (`organization.domain_public`) and a join never matches one, even a claim stored before the
+* list grew. The list is the large free consumer mailbox providers, the internet providers
+* that give every customer an address, and the common national ones; a company's own domain
+* is never on it.
+*
+* Providers that sell a mailbox under many country domains (`yahoo.co.uk`, `yahoo.fr`,
+* `hotmail.de`, …) are in {@link PUBLIC_EMAIL_BRANDS} instead.
+*/
+declare const PUBLIC_EMAIL_DOMAINS: readonly string[];
+/**
+* Provider names whose every country domain is public: `yahoo.com`, `yahoo.co.uk`, `yahoo.fr`
+* and `yahoo.co.jp` are all `yahoo`. A domain matches when its **first** label is one of
+* these and what follows is a top-level domain, or a short second-level one and a top-level
+* one (`co.uk`, `com.br`): `yahoo.com` and `hotmail.co.uk` match, `yahoo.acme.com` and
+* `notyahoo.com` do not.
+*/
+declare const PUBLIC_EMAIL_BRANDS: readonly string[];
+/**
+* Whether anyone can get an address on this domain: it is on {@link PUBLIC_EMAIL_DOMAINS} or
+* is a country domain of one of {@link PUBLIC_EMAIL_BRANDS}.
+*
+* @param domain - A domain in the spelling of {@link DOMAIN_PATTERN}.
+* @returns `true` for a public mail domain.
+* @example
+* ```ts
+* isPublicEmailDomain('gmail.com') // true
+* isPublicEmailDomain('yahoo.co.uk') // true
+* isPublicEmailDomain('acme.com') // false
+* ```
+*/
+declare function isPublicEmailDomain(domain: string): boolean;
+/**
+* Why a string cannot be claimed as a domain, or `null` when it can.
+*
+* @param domain - The text to judge.
+* @returns `grammar` (not a lower-case ASCII domain name: upper case, Unicode, an IP address,
+*   a single label), `length` (a label over {@link MAX_DOMAIN_LABEL_LENGTH}, the whole over
+*   {@link MAX_DOMAIN_LENGTH} or under {@link MIN_DOMAIN_LENGTH}), `public` (a public mail
+*   domain), or `null`.
+* @example
+* ```ts
+* domainRefusal('acme.com') // null
+* domainRefusal('gmail.com') // 'public'
+* domainRefusal('bücher.example') // 'grammar'
+* ```
+*/
+declare function domainRefusal(domain: string): DomainRefusal | null;
+/**
+* The domain of an email address in the spelling the server stores (lower case), or `null`
+* when the text has no `@` or ends in one.
+*
+* It is everything after the **last** `@`, unchanged: no subdomain is cut off, so
+* `a@mail.acme.com` is `mail.acme.com` and **never** matches a claim on `acme.com`. Whether the
+* result is a domain at all is {@link domainRefusal}'s question.
+*
+* @param address - An email address, normalised (lower case) by the caller.
+* @returns The part after the last `@`, or `null`.
+* @example
+* ```ts
+* domainOfAddress('ada@acme.com') // 'acme.com'
+* domainOfAddress('ada@mail.acme.com') // 'mail.acme.com'
+* ```
+*/
+declare function domainOfAddress(address: string): string | null;
+export { DOMAIN_PATTERN, DOMAIN_REMINDER_DAYS, DOMAIN_REVERIFICATION_GRACE_DAYS, DOMAIN_VERIFICATION_LIFETIME_DAYS, DomainRefusal, MAX_DOMAINS_PER_ORGANIZATION, MAX_DOMAIN_LABEL_LENGTH, MAX_DOMAIN_LENGTH, MIN_DOMAIN_LENGTH, ORGANIZATION_DOMAIN_MODES, ORGANIZATION_DOMAIN_STATUSES, OrganizationDomainMode, OrganizationDomainStatus, PUBLIC_EMAIL_BRANDS, PUBLIC_EMAIL_DOMAINS, domainOfAddress, domainRefusal, isPublicEmailDomain };

package/dist/organization-domain-rules.js

@@ -0,0 +1,34 @@
+import {
+  MAX_DOMAIN_LENGTH2,
+  MAX_DOMAIN_LABEL_LENGTH2,
+  MIN_DOMAIN_LENGTH2,
+  MAX_DOMAINS_PER_ORGANIZATION2,
+  DOMAIN_VERIFICATION_LIFETIME_DAYS2,
+  DOMAIN_REMINDER_DAYS2,
+  DOMAIN_REVERIFICATION_GRACE_DAYS2,
+  ORGANIZATION_DOMAIN_STATUSES2,
+  ORGANIZATION_DOMAIN_MODES2,
+  DOMAIN_PATTERN2,
+  PUBLIC_EMAIL_DOMAINS2,
+  PUBLIC_EMAIL_BRANDS2,
+  isPublicEmailDomain2,
+  domainRefusal2,
+  domainOfAddress2
+} from "./shared/chunk-cdg41bxh.js";
+export {
+  DOMAIN_PATTERN2 as DOMAIN_PATTERN,
+  DOMAIN_REMINDER_DAYS2 as DOMAIN_REMINDER_DAYS,
+  DOMAIN_REVERIFICATION_GRACE_DAYS2 as DOMAIN_REVERIFICATION_GRACE_DAYS,
+  DOMAIN_VERIFICATION_LIFETIME_DAYS2 as DOMAIN_VERIFICATION_LIFETIME_DAYS,
+  MAX_DOMAINS_PER_ORGANIZATION2 as MAX_DOMAINS_PER_ORGANIZATION,
+  MAX_DOMAIN_LABEL_LENGTH2 as MAX_DOMAIN_LABEL_LENGTH,
+  MAX_DOMAIN_LENGTH2 as MAX_DOMAIN_LENGTH,
+  MIN_DOMAIN_LENGTH2 as MIN_DOMAIN_LENGTH,
+  ORGANIZATION_DOMAIN_MODES2 as ORGANIZATION_DOMAIN_MODES,
+  ORGANIZATION_DOMAIN_STATUSES2 as ORGANIZATION_DOMAIN_STATUSES,
+  PUBLIC_EMAIL_BRANDS2 as PUBLIC_EMAIL_BRANDS,
+  PUBLIC_EMAIL_DOMAINS2 as PUBLIC_EMAIL_DOMAINS,
+  domainOfAddress2 as domainOfAddress,
+  domainRefusal2 as domainRefusal,
+  isPublicEmailDomain2 as isPublicEmailDomain
+};

package/dist/organization-permissions.d.ts

@@ -0,0 +1,185 @@
+/**
+* How many permissions one role can hold. The permissions of the active organization's role are
+* a claim of every access token, so the number is capped.
+*/
+declare const MAX_PERMISSIONS_PER_ROLE = 32;
+/** How many custom roles an environment can define, beside the built-in ones. */
+declare const MAX_CUSTOM_ROLES = 50;
+/** The longest a permission key can be, in characters. */
+declare const MAX_PERMISSION_KEY_LENGTH = 100;
+/**
+* The grammar of a role's key: a lower-case letter, then lower-case letters, digits and
+* underscores, up to 32 characters (`admin`, `billing_manager`). Unique in its environment.
+*
+* @example
+* ```ts
+* ROLE_KEY_PATTERN.test('billing_manager') // true
+* ```
+*/
+declare const ROLE_KEY_PATTERN: RegExp;
+/**
+* The grammar of a permission key: `org:<feature>:<action>`, each of the last two
+* a lower-case letter followed by lower-case letters, digits and underscores (at most 32
+* characters); or, for the permissions Tula's own routes check, `org:sys:<feature>:<action>`.
+* No dot, no other separator: a key is safe in a token and in a URL. The feature `sys` is
+* reserved: a custom key never has it, and a system key is one of
+* {@link SYSTEM_PERMISSIONS}.
+*
+* The pattern is the grammar alone. Whether a role may hold a key is
+* {@link rolePermissionRefusal}.
+*
+* @example
+* ```ts
+* PERMISSION_KEY_PATTERN.test('org:billing:read') // true
+* PERMISSION_KEY_PATTERN.test('org:sys:memberships:manage') // true
+* PERMISSION_KEY_PATTERN.test('billing.read') // false
+* ```
+*/
+declare const PERMISSION_KEY_PATTERN: RegExp;
+/**
+* The permissions Tula's own organization routes check. The same keys an app's
+* server checks with `has({ permission })`, so Tula's routes hold no privilege an app cannot
+* also give a role.
+*/
+declare const SYSTEM_PERMISSIONS: readonly ["org:sys:organization:manage", "org:sys:organization:delete", "org:sys:memberships:read", "org:sys:memberships:manage", "org:sys:invitations:manage", "org:sys:domains:manage", "org:sys:sso:manage"];
+/** One of {@link SYSTEM_PERMISSIONS}. */
+type SystemPermission = (typeof SYSTEM_PERMISSIONS)[number];
+/**
+* The permission that makes a member a manager of the organization's members. **Every
+* organization keeps at least one member who holds it**: the last such member cannot be
+* removed or moved to a role without it (`organization.last_manager`), and a role's
+* permissions cannot be changed so that an organization would be left with none.
+*/
+declare const MEMBERSHIPS_MANAGE_PERMISSION: SystemPermission;
+/**
+* The permission that lets a member claim, verify, change and remove the organization's
+* domains through the client routes. Read from the member's
+* role at the time of the request, never from a token.
+*/
+declare const DOMAINS_MANAGE_PERMISSION: SystemPermission;
+/**
+* The permission that lets a member invite people to the organization and withdraw
+* invitations. Checked on the server from the membership as it is now,
+* never from a token's claims alone.
+*/
+declare const INVITATIONS_MANAGE_PERMISSION: SystemPermission;
+/**
+* The permission that lets a member rename the organization through the client routes.
+* Read from the membership now, never from a token's claims alone.
+*/
+declare const ORGANIZATION_MANAGE_PERMISSION: SystemPermission;
+/**
+* The permission that lets a member delete the organization through the client routes.
+* Read from the membership now, never from a token's claims alone.
+*/
+declare const ORGANIZATION_DELETE_PERMISSION: SystemPermission;
+/**
+* The permission that lets a member read the organization's member list through the client
+* routes. `org:sys:memberships:manage` also reads it.
+*/
+declare const MEMBERSHIPS_READ_PERMISSION: SystemPermission;
+/**
+* The permission that lets a member manage the organization's single sign-on connections.
+* Read from the membership now, never from a token's claims alone.
+*/
+declare const SSO_MANAGE_PERMISSION: SystemPermission;
+/** A built-in role: its key, its name and the permissions it holds. */
+interface BuiltInRole {
+	readonly key: string;
+	readonly name: string;
+	readonly permissions: readonly SystemPermission[];
+}
+/**
+* The two roles every environment has: `admin` holds every system permission,
+* `member` may read the member list. They cannot be deleted, renamed or given other
+* permissions. They exist as rows of every environment (`ensureBuiltInRoles`) so that a
+* membership refers to a role the way it does to a custom one.
+*/
+declare const BUILT_IN_ROLES: readonly BuiltInRole[];
+/**
+* Whether a string is one of {@link SYSTEM_PERMISSIONS}.
+*
+* @param key - A permission key.
+* @returns `true` for one of Tula's own permissions.
+*
+* @example
+* ```ts
+* isSystemPermission('org:sys:memberships:read') // true
+* isSystemPermission('org:billing:read') // false
+* ```
+*/
+declare function isSystemPermission(key: string): key is SystemPermission;
+/**
+* Whether a string is the key of a built-in role (`admin`, `member`). A custom role never
+* takes one of these keys.
+*
+* @param key - A role key.
+* @returns `true` for a built-in role's key.
+*
+* @example
+* ```ts
+* isBuiltInRoleKey('admin') // true
+* isBuiltInRoleKey('billing_manager') // false
+* ```
+*/
+declare function isBuiltInRoleKey(key: string): boolean;
+/** Why a custom role may not hold a permission key. */
+type RolePermissionRefusal = "grammar" | "reserved";
+/**
+* Whether a **custom** role may hold a permission key.
+*
+* A custom role holds the operator's own permissions (`org:billing:read`) and may also hold
+* any of Tula's {@link SYSTEM_PERMISSIONS}, so that a role such as `owner` can manage members.
+* It can never hold a key of the reserved `sys` feature that is not on that list: a key Tula
+* does not check would mean nothing today and silently grant a privilege tomorrow, when a
+* later version gives that key a meaning.
+*
+* @param key - A permission key.
+* @returns `null` when the role may hold it, `'grammar'` when it is not a permission key at
+*   all, `'reserved'` when it is a `sys` key Tula does not define.
+*
+* @example
+* ```ts
+* rolePermissionRefusal('org:billing:read') // null
+* rolePermissionRefusal('org:sys:memberships:manage') // null
+* rolePermissionRefusal('org:sys:billing:read') // 'reserved'
+* rolePermissionRefusal('billing.read') // 'grammar'
+* ```
+*/
+declare function rolePermissionRefusal(key: string): RolePermissionRefusal | null;
+/**
+* The permissions of a role as a set: each key once, sorted. How a role is stored, compared
+* and returned, so that the order a caller listed them in is never a difference.
+*
+* @param permissions - Permission keys, in any order, possibly with repeats.
+* @returns The distinct keys, sorted.
+*
+* @example
+* ```ts
+* normalizePermissions(['org:b:read', 'org:a:read', 'org:b:read']) // ['org:a:read', 'org:b:read']
+* ```
+*/
+declare function normalizePermissions(permissions: readonly string[]): string[];
+/**
+* What a change to a custom role's permissions widens, the one rule the server records
+* `weakened` with, `tula apply` asks `--allow-weaker` with and the dashboard asks first with.
+*
+* **Adding a permission to a role is a weakening** (members who hold the role gain access at
+* their next refresh); taking one away is not. **Creating a role is not one**: no member holds
+* it until someone assigns it, and that assignment is a membership change of its own. Deleting
+* a role is not one: only a role no member holds can be deleted.
+*
+* @param before - The permissions the role has, or `null` for a role that does not exist yet.
+* @param after - The permissions it would have.
+* @returns `['permissions']` when `after` holds a key `before` does not, otherwise `[]`.
+*
+* @example
+* ```ts
+* organizationRoleWeakenings(['org:billing:read'], ['org:billing:read', 'org:billing:write'])
+* // ['permissions']
+* organizationRoleWeakenings(['org:billing:read'], []) // []
+* organizationRoleWeakenings(null, ['org:billing:read']) // []
+* ```
+*/
+declare function organizationRoleWeakenings(before: readonly string[] | null, after: readonly string[]): "permissions"[];
+export { BUILT_IN_ROLES, BuiltInRole, DOMAINS_MANAGE_PERMISSION, INVITATIONS_MANAGE_PERMISSION, MAX_CUSTOM_ROLES, MAX_PERMISSIONS_PER_ROLE, MAX_PERMISSION_KEY_LENGTH, MEMBERSHIPS_MANAGE_PERMISSION, MEMBERSHIPS_READ_PERMISSION, ORGANIZATION_DELETE_PERMISSION, ORGANIZATION_MANAGE_PERMISSION, PERMISSION_KEY_PATTERN, ROLE_KEY_PATTERN, RolePermissionRefusal, SSO_MANAGE_PERMISSION, SYSTEM_PERMISSIONS, SystemPermission, isBuiltInRoleKey, isSystemPermission, normalizePermissions, organizationRoleWeakenings, rolePermissionRefusal };

package/dist/organization-permissions.js

@@ -0,0 +1,42 @@
+import {
+  MAX_PERMISSIONS_PER_ROLE2,
+  MAX_CUSTOM_ROLES2,
+  MAX_PERMISSION_KEY_LENGTH2,
+  ROLE_KEY_PATTERN2,
+  PERMISSION_KEY_PATTERN2,
+  SYSTEM_PERMISSIONS2,
+  MEMBERSHIPS_MANAGE_PERMISSION2,
+  DOMAINS_MANAGE_PERMISSION2,
+  INVITATIONS_MANAGE_PERMISSION2,
+  ORGANIZATION_MANAGE_PERMISSION2,
+  ORGANIZATION_DELETE_PERMISSION2,
+  MEMBERSHIPS_READ_PERMISSION2,
+  SSO_MANAGE_PERMISSION2,
+  BUILT_IN_ROLES2,
+  isSystemPermission2,
+  isBuiltInRoleKey2,
+  rolePermissionRefusal2,
+  normalizePermissions2,
+  organizationRoleWeakenings2
+} from "./shared/chunk-yzgakhtb.js";
+export {
+  BUILT_IN_ROLES2 as BUILT_IN_ROLES,
+  DOMAINS_MANAGE_PERMISSION2 as DOMAINS_MANAGE_PERMISSION,
+  INVITATIONS_MANAGE_PERMISSION2 as INVITATIONS_MANAGE_PERMISSION,
+  MAX_CUSTOM_ROLES2 as MAX_CUSTOM_ROLES,
+  MAX_PERMISSIONS_PER_ROLE2 as MAX_PERMISSIONS_PER_ROLE,
+  MAX_PERMISSION_KEY_LENGTH2 as MAX_PERMISSION_KEY_LENGTH,
+  MEMBERSHIPS_MANAGE_PERMISSION2 as MEMBERSHIPS_MANAGE_PERMISSION,
+  MEMBERSHIPS_READ_PERMISSION2 as MEMBERSHIPS_READ_PERMISSION,
+  ORGANIZATION_DELETE_PERMISSION2 as ORGANIZATION_DELETE_PERMISSION,
+  ORGANIZATION_MANAGE_PERMISSION2 as ORGANIZATION_MANAGE_PERMISSION,
+  PERMISSION_KEY_PATTERN2 as PERMISSION_KEY_PATTERN,
+  ROLE_KEY_PATTERN2 as ROLE_KEY_PATTERN,
+  SSO_MANAGE_PERMISSION2 as SSO_MANAGE_PERMISSION,
+  SYSTEM_PERMISSIONS2 as SYSTEM_PERMISSIONS,
+  isBuiltInRoleKey2 as isBuiltInRoleKey,
+  isSystemPermission2 as isSystemPermission,
+  normalizePermissions2 as normalizePermissions,
+  organizationRoleWeakenings2 as organizationRoleWeakenings,
+  rolePermissionRefusal2 as rolePermissionRefusal
+};

package/dist/password-rules.d.ts

@@ -108,6 +108,22 @@ declare const ERROR_DEFINITIONS: {
 		readonly status: 409;
 		readonly message: "This account has no password yet. Use \"forgot password\" to set one.";
 	};
+	readonly "import.unsupported_algorithm": {
+		readonly status: 422;
+		readonly message: "That password hash algorithm is not supported.";
+	};
+	readonly "import.hash_malformed": {
+		readonly status: 422;
+		readonly message: "That password hash is malformed.";
+	};
+	readonly "import.hash_parameters_too_weak": {
+		readonly status: 422;
+		readonly message: "That password hash is too weak to import.";
+	};
+	readonly "import.hash_parameters_too_costly": {
+		readonly status: 422;
+		readonly message: "That password hash is too costly to verify.";
+	};
 	readonly "verification.invalid_code": {
 		readonly status: 422;
 		readonly message: "That code is incorrect.";
@@ -300,6 +316,194 @@ declare const ERROR_DEFINITIONS: {
 		readonly status: 400;
 		readonly message: "Signing in here needs a device key.";
 	};
+	readonly "user.last_organization_manager": {
+		readonly status: 409;
+		readonly message: "This user is the only manager of an organization. Add another manager or delete the organization first.";
+	};
+	readonly "user.managed": {
+		readonly status: 403;
+		readonly message: "This account is managed by your organization. Ask your administrator to change it.";
+	};
+	readonly "organization.disabled": {
+		readonly status: 403;
+		readonly message: "Organizations are not enabled for this environment.";
+	};
+	readonly "organization.slug_taken": {
+		readonly status: 409;
+		readonly message: "An organization with that slug already exists.";
+	};
+	readonly "organization.member_exists": {
+		readonly status: 409;
+		readonly message: "That user is already a member of this organization.";
+	};
+	readonly "organization.last_manager": {
+		readonly status: 409;
+		readonly message: "An organization must keep at least one member who can manage its members.";
+	};
+	readonly "organization.role_unknown": {
+		readonly status: 422;
+		readonly message: "That role does not exist in this environment.";
+	};
+	readonly "organization.not_a_member": {
+		readonly status: 403;
+		readonly message: "You are not a member of that organization.";
+	};
+	readonly "organization.creation_disabled": {
+		readonly status: 403;
+		readonly message: "Creating an organization is not allowed in this environment.";
+	};
+	readonly "organization.limit_reached": {
+		readonly status: 403;
+		readonly message: "You have reached the number of organizations you can create.";
+	};
+	readonly "organization.personal_account_disabled": {
+		readonly status: 409;
+		readonly message: "An organization must be active in this environment.";
+	};
+	readonly "organization.role_exists": {
+		readonly status: 409;
+		readonly message: "A role with that key already exists in this environment.";
+	};
+	readonly "organization.role_in_use": {
+		readonly status: 409;
+		readonly message: "Members still hold this role. Give them another role first.";
+	};
+	readonly "organization.role_built_in": {
+		readonly status: 409;
+		readonly message: "A built-in role cannot be changed or deleted.";
+	};
+	readonly "organization.role_limit": {
+		readonly status: 409;
+		readonly message: "This environment has the most custom roles it can have.";
+	};
+	readonly "organization.permission_required": {
+		readonly status: 403;
+		readonly message: "Your role does not allow that.";
+	};
+	readonly "organization.role_not_assignable": {
+		readonly status: 403;
+		readonly message: "You can only invite to a role no stronger than yours.";
+	};
+	readonly "organization.invitation_exists": {
+		readonly status: 409;
+		readonly message: "That address already has a pending invitation.";
+	};
+	readonly "organization.invitation_not_found": {
+		readonly status: 404;
+		readonly message: "This invitation does not exist.";
+	};
+	readonly "organization.invitation_expired": {
+		readonly status: 410;
+		readonly message: "This invitation has expired.";
+	};
+	readonly "organization.invitation_revoked": {
+		readonly status: 410;
+		readonly message: "This invitation was withdrawn.";
+	};
+	readonly "organization.invitation_used": {
+		readonly status: 410;
+		readonly message: "This invitation was already used.";
+	};
+	readonly "organization.invitation_wrong_account": {
+		readonly status: 403;
+		readonly message: "This invitation was sent to another email address.";
+	};
+	readonly "organization.invitation_email_unverified": {
+		readonly status: 403;
+		readonly message: "Verify your email address to accept this invitation.";
+	};
+	readonly "organization.invitation_role_gone": {
+		readonly status: 409;
+		readonly message: "The role this invitation offers no longer exists.";
+	};
+	readonly "organization.domain_public": {
+		readonly status: 422;
+		readonly message: "A public email domain cannot be claimed by an organization.";
+	};
+	readonly "organization.domain_taken": {
+		readonly status: 409;
+		readonly message: "That domain is verified for an organization already.";
+	};
+	readonly "organization.domain_address_mismatch": {
+		readonly status: 422;
+		readonly message: "That address is not on the domain.";
+	};
+	readonly "organization.domain_limit": {
+		readonly status: 409;
+		readonly message: "This organization has the most domains it can have.";
+	};
+	readonly "organization.suggestion_unavailable": {
+		readonly status: 403;
+		readonly message: "You cannot join that organization.";
+	};
+	readonly "sso.disabled": {
+		readonly status: 403;
+		readonly message: "Single sign-on is not enabled for this environment.";
+	};
+	readonly "sso.connection_not_found": {
+		readonly status: 404;
+		readonly message: "No such single sign-on connection.";
+	};
+	readonly "sso.name_taken": {
+		readonly status: 409;
+		readonly message: "The organization already has a connection with that name.";
+	};
+	readonly "sso.domain_taken": {
+		readonly status: 409;
+		readonly message: "Another active connection already serves one of those domains.";
+	};
+	readonly "sso.domain_not_verified": {
+		readonly status: 422;
+		readonly message: "Every domain must be one of the organization's verified domains.";
+	};
+	readonly "sso.issuer_not_allowed": {
+		readonly status: 422;
+		readonly message: "The issuer is not an address the server may call.";
+	};
+	readonly "sso.saml_invalid": {
+		readonly status: 422;
+		readonly message: "The SAML settings could not be read or are incomplete.";
+	};
+	readonly "sso.connection_in_use": {
+		readonly status: 409;
+		readonly message: "The connection is active; disable it before deleting it.";
+	};
+	readonly "sso.invalid_transition": {
+		readonly status: 409;
+		readonly message: "A connection cannot move to that status from its current one.";
+	};
+	readonly "sso.url_not_https": {
+		readonly status: 422;
+		readonly message: "The identity provider’s sign-in address must start with https.";
+	};
+	readonly "sso.test_required": {
+		readonly status: 409;
+		readonly message: "Run a passing test sign-in of the connection’s current settings before activating it.";
+	};
+	readonly "sso.test_not_found": {
+		readonly status: 404;
+		readonly message: "No such test sign-in.";
+	};
+	readonly "sso.role_not_allowed": {
+		readonly status: 403;
+		readonly message: "A setup link cannot map a group to a role that holds system permissions.";
+	};
+	readonly "sso.unavailable": {
+		readonly status: 400;
+		readonly message: "Single sign-on is not available for that address.";
+	};
+	readonly "sso.provider_error": {
+		readonly status: 401;
+		readonly message: "The identity provider did not sign you in.";
+	};
+	readonly "sso.user_not_provisioned": {
+		readonly status: 403;
+		readonly message: "Your account has not been set up for this organization. Ask its administrator.";
+	};
+	readonly "sso.email_domain_mismatch": {
+		readonly status: 403;
+		readonly message: "Your email address is not on this connection's domains.";
+	};
 	readonly rate_limited: {
 		readonly status: 429;
 		readonly message: "Too many requests. Try again shortly.";

package/dist/redirect-url.d.ts

@@ -9,7 +9,7 @@
 * {@link REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM}, are refused by this list alone, and a
 * scheme an operating system handles that nobody put here passes. What bounds that is not
 * the list: every entry of `urls.allowedRedirectUrls` is written by the operator by hand,
-* and a redirect carries only a ticket that is useless without the binding (ADR 0044).
+* and a redirect carries only a ticket that is useless without the binding.
 *
 * @example
 * ```ts
@@ -134,7 +134,7 @@ declare function isRedirectUrl(value: string): boolean;
 */
 declare function isCustomSchemeRedirectUrl(value: string): boolean;
 /**
-* The providers whose authorization code Tula binds to the attempt with PKCE (ADR 0026): the
+* The providers whose authorization code Tula binds to the attempt with PKCE: the
 * code is redeemable only with the verifier the attempt holds.
 *
 * @example
@@ -146,7 +146,7 @@ declare const OAUTH_PROVIDERS_WITH_PKCE: readonly ["google", "github", "microsof
 /**
 * The providers that do **not** bind their code with PKCE, as a fact about the provider and
 * not a setting: Apple and LinkedIn document none, and Facebook's has it only in a flow that
-* is not used (ADR 0026).
+* is not used.
 *
 * A provider sign-in with one of them is never returned to a custom scheme
 * ({@link customSchemeRedirectRefusal}). A new provider is added to this list or to

package/dist/redirect-url.js

@@ -10,7 +10,7 @@ import {
   bindsCodeWithPkce2,
   CUSTOM_SCHEME_REDIRECT_REFUSALS2,
   customSchemeRedirectRefusal2
-} from "./shared/chunk-r202nxfw.js";
+} from "./shared/chunk-n1jdq72m.js";
 export {
   CUSTOM_SCHEME_REDIRECT_REFUSALS2 as CUSTOM_SCHEME_REDIRECT_REFUSALS,
   OAUTH_PROVIDERS_WITHOUT_PKCE2 as OAUTH_PROVIDERS_WITHOUT_PKCE,

package/dist/shared/{chunk-q309e9bk.js → chunk-4hytq4je.js}

@@ -12,8 +12,10 @@ var DASHBOARD_HEADER_VALUE2 = "1";
 var ENVIRONMENT_HEADER2 = "x-tula-environment";
 var DASHBOARD_SESSION_COOKIE2 = "tula_dashboard";
 var EMAIL_LINK_TOKEN_PARAM2 = "tula_link";
+var ORGANIZATION_INVITATION_TOKEN_PARAM2 = "tula_invitation";
 var EMAIL_LINK_ATTEMPT_PARAM2 = "tula_attempt";
 var OAUTH_TICKET_PARAM2 = "tula_ticket";
 var OAUTH_ERROR_PARAM2 = "tula_error";
+var SETUP_LINK_HEADER2 = "x-tula-setup-token";
 
-export { PUBLISHABLE_KEY_HEADER2, CLIENT_HEADER2, SESSION_PROFILE_HEADER2, FLOW_ATTEMPT_HEADER2, CAN_STILL_SIGN_IN_HEADER2, CONFIG_MANAGED_BY_HEADER2, CONFIG_HASH_HEADER2, CONFIG_UNMANAGED2, DASHBOARD_HEADER2, DASHBOARD_HEADER_VALUE2, ENVIRONMENT_HEADER2, DASHBOARD_SESSION_COOKIE2, EMAIL_LINK_TOKEN_PARAM2, EMAIL_LINK_ATTEMPT_PARAM2, OAUTH_TICKET_PARAM2, OAUTH_ERROR_PARAM2 };
+export { PUBLISHABLE_KEY_HEADER2, CLIENT_HEADER2, SESSION_PROFILE_HEADER2, FLOW_ATTEMPT_HEADER2, CAN_STILL_SIGN_IN_HEADER2, CONFIG_MANAGED_BY_HEADER2, CONFIG_HASH_HEADER2, CONFIG_UNMANAGED2, DASHBOARD_HEADER2, DASHBOARD_HEADER_VALUE2, ENVIRONMENT_HEADER2, DASHBOARD_SESSION_COOKIE2, EMAIL_LINK_TOKEN_PARAM2, ORGANIZATION_INVITATION_TOKEN_PARAM2, EMAIL_LINK_ATTEMPT_PARAM2, OAUTH_TICKET_PARAM2, OAUTH_ERROR_PARAM2, SETUP_LINK_HEADER2 };